CVE-2026-126355

The Hono web application framework is vulnerable to Cross-Site Request Forgery (CSRF) in versions prior to 4.13.16 because the csrf() middleware fails to validate text/ping requests generated by Chromium hyperlink auditing. Attackers can use actions in Chrome and Edge to send cross-origin creden...

CVE-2025-61304

CVE-2025-61304 "OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address" In the background the ping extension is using the command prompt of Windows to perform the ping. The input field for the Test Target Host is also 1024 chars long. After th...

CVE-2021-46704-POC

CVE-2021-46704-POC CVE-2021-46704 GenieACS Command Injection POC Affecting genieacs package, versions =1.2.0 1.2.8 How to fix? Upgrade genieacs to version 1.2.8 or higher. Affected versions of this package are vulnerable to Command Injection via the ping host argument lib/ui/api.ts and lib/ping.t...

CVE-2019-11224

Modero AMX Code Execution CVE-2019-11224 This repo contains a few sources about CVE-2019–11224 https://link.medium.com/zukA0oCnV8 because I noticed that the link no longer works on the official NIST website. Modero AMX devices are essentially touch panel devices for meeting rooms, they can be...

cve-2010-3847

CVE-2010-3847 script Meant to automate the exploit discussed in http://marc.info/?l=full-disclosure&m=128776663124692&w=2. Tested on CentOS 5 x86. The DSO it outputs is compiled from the following code: include include include void attributeconstructor init setuid0; system"/bin/bash"; Usage...

FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR

A flaw was found in FreeRDP. A remote attacker, specifically a malicious RD Gateway peer, could send a crafted WebSocket Ping frame with an extended payload length. This action triggers an an integer overflow in the StreamEnsureRemainingCapacity function, leading to an integer wraparound and a...

PT-2026-146077

Summary csrf validates a request only when its Content-Type is one of the three types an HTML form can send. Chromium's hyperlink auditing sends a cross-origin POST with the user's cookies and the content type text/ping, which is not in that list. The middleware does not look at Origin or...

FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR

A flaw was found in FreeRDP. A remote attacker, specifically a malicious RD Gateway peer, could send a crafted WebSocket Ping frame with an extended payload length. This action triggers an an integer overflow in the StreamEnsureRemainingCapacity function, leading to an integer wraparound and a...

CVE-2026-123374 Apache Roller: Deserialization of untrusted data in weblog update ping responses

Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects...

EUVD-2026-123520

Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects...

Forced Browsing

Overview Affected versions of this package are vulnerable to Forced Browsing of service metadata, because the exposeServiceMetadata parameter is enforced only on the ?wsdl, ?wsdl2, and ?xsd queries in HTTPWorker and ListingAgent. An anonymous caller can read the operation names and the request an...

CVE-2025-70521

A flaw was found in the Fanvil x7a diagnostic ping tool. The device management portal fails to properly validate user-supplied input. An unauthenticated remote attacker can exploit this issue to execute arbitrary commands and run malicious code within the underlying operating system. Mitigation...

USN-8972-2: HAProxy regression

USN-8972-1 fixed vulnerabilities in HAProxy. On Ubuntu 22.04 LTS, the update caused a regression when processing certain chunked requests. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that HAProxy incorrectly handled truncated...

CVE-2026-121930

A weakness has been identified in Linksys WRT54GL 4.30.18. The affected element is the function system of the file apply.cgi of the component Ping Diagnostic. This manipulation of the argument pingip causes os command injection. The attack can be initiated remotely. The exploit has been made...

CVE-2026-121930

A command injection vulnerability exists in the Linksys WRT54GL (version 4.30.18) within the Ping Diagnostic component. The flaw is located in the system function of the apply.cgi file, where improper handling of the ping_ip argument allows for remote OS command injection. While a public exploit ...

CVE-2026-121930 Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection

A weakness has been identified in Linksys WRT54GL 4.30.18. The affected element is the function system of the file apply.cgi of the component Ping Diagnostic. This manipulation of the argument pingip causes os command injection. The attack can be initiated remotely. The exploit has been made...

EUVD-2026-117019

A weakness has been identified in Linksys WRT54GL 4.30.18. The affected element is the function system of the file apply.cgi of the component Ping Diagnostic. This manipulation of the argument pingip causes os command injection. The attack can be initiated remotely. The exploit has been made...

PT-2026-137096

Name of the Vulnerable Software and Affected Versions Linksys WRT54GL version 4.30.18 Description An OS command injection flaw exists in the Ping Diagnostic component. A remote network attacker with administrator credentials can execute arbitrary operating system commands by manipulating the ping...

PT-2026-137098

Name of the Vulnerable Software and Affected Versions Linksys E5350 version 1.0.00.037 Description An OS command injection flaw exists in the /wizard/apply.cgi endpoint. This issue occurs within the system function when the ping ip or traceroute ip variables are manipulated, allowing a remote...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : HAProxy vulnerabilities (USN-8972-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8972-1 advisory. It was discovered that HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could possibly use thi...